Recently, I’ve been seeing new L1/L2 projects roll out incentive programs to attract TVL. Old users are rushing in while also complaining, “Dig/extract/sell”… I mean, it’s lively and all, but for newcomers, they just want to know whether the project is legit. Usually, I check three things first: GitHub, audit reports, and how upgrades/multisigs are handled.

Don’t just look at GitHub stars—see whether people are actively working, whether questions are getting answered, and whether important changes are explained. For audit reports, don’t just focus on “passed”; pay attention to whether high-risk issues were fixed, and whether the fixes were actually thorough. And then there’s upgrade multisigs: who the signers are, how many signatures are required, and whether there’s a timelock (the kind that gives everyone time to react). These matter more than slogans. In any case, I’d rather earn a little less than get “upgraded” and have my account taken overnight. (My protective, mom-mode kicks in again.)